Key takeaways
- Control who can read and change source code and related tools.
- Unauthorised changes to source code can introduce vulnerabilities or backdoors.
- Start here: store code in a version control system with access restrictions.
Purpose
Control who can read and change source code and related tools.
Requirement
Requirement summaryRead and write access to source code, development tools and software libraries shall be appropriately managed.
Why it matters
Unauthorised changes to source code can introduce vulnerabilities or backdoors.
How to implement
- Store code in a version control system with access restrictions.
- Require reviews before merging to main branches.
- Limit write access to repositories that need it.
- Protect secrets and audit repository access.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.4. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules on who can see and change source code.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.4 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A list of who can access your code repositories, reviewed regularly.
- Settings showing changes need review and approval before being merged.
- Proof that leavers lost repository access.
Things you should be able to show or explain
- Be able to show the repository protection settings.
How much to show: Two or three repositories for live products.
Common mistakes
- Former staff still have access.
- Changes merged with no review.
- Direct pushes to production branches.
- Former contractors still in the code organisation.
- Tip: Use branch protection and code review.
Policies & documents to have
- Access Control Policy
FAQ
Is A.8.4 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.4?
Be ready to explain how the control works in your organisation and to provide things like: Your rules on who can see and change source code…